GitHub enforces FIDO 2FA and seven-day token limits after Shai-Hulud npm attack to boost supply chain security.

GitHub MCP Registry makes Model Context Protocol servers with GitHub repos discoverable from Visual Studio Code.

The novel malware strain is being dubbed Shai-Hulud — after the name for the giant sandworms in Frank Herbert’s Dune novel ...

"Each published package becomes a new distribution vector: as soon as someone installs it, the worm executes, replicates, and ...

BugBug encourages testers and developers to take advantage of its 14-day free trial of advanced features by visiting BugBug Pricing via the website today to experience a test automation tool that ...

The Python Software Foundation team has invalidated all PyPI tokens stolen in the GhostAction supply chain attack in early ...

Google’s Angular team has open-sourced a tool that evaluates the quality of web code generated by LLMs. It works with any web ...

The frontend developer conference covers the whole spectrum between the newest developer tools and the fundamental knowledge of web development.

The bundle.js script is designed to steal npm, GitHub, AWS and GCP tokens. But it also installs TruffleHog – an open source ...

A new self-replicating worm dubbed Shai-Hulud has compromised over 180 npm packages, stealing credentials and spreading ...

Security researchers have identified at least 187 npm packages compromised in an ongoing supply chain attack. The coordinated ...

Plus: An investigation reveals how US tech companies reportedly helped build China’s sweeping surveillance state, and two ...